The Complexity of Cyber Attacks in a New Layered-Security Model and the Maximum-Weight, Rooted-Subtree Problem

Abstract

This paper makes three contributions to cyber-security research. First, we define a model for cyber-security systems and the concept of a cyber-security attack within the model's framework. The model highlights the importance of game-over components-critical system components which if acquired will give an adversary the ability to defeat a system completely. The model is based on systems that use defense-in-depth/layered-security approaches, as many systems do. In the model we define the concept of penetration cost, which is the cost that must be paid in order to break into the next layer of security. Second, we define natural decision and optimization problems based on cyber-security attacks in terms of doubly weighted trees, and analyze their complexity. More precisely, given a tree T rooted at a vertex r, a penetrating cost edge function c on T , a target-acquisition vertex function p on T , the attacker's budget and the game-over threshold B, G ∈ Q + respectively, we consider the problem of determining the existence of a rooted subtree T ′ of T within the attacker's budget (that is, the sum of the costs of the edges in T ′ is less than or equal to B) with total acquisition value more than the game-over threshold (that is, the sum of the target values of the nodes in T ′ is greater than or equal to G). We prove that the general version of this problem is intractable, but does admit a polynomial time approximation scheme. We also analyze the complexity of three restricted versions of the problems, where the penetration cost is the constant function, integer-valued, and rational-valued among a given fixed number of distinct values. Using recursion and dynamicprogramming techniques, we show that for constant penetration costs an optimal cyber-attack strategy can be found in polynomial time, and for integer-valued and rational-valued penetration costs optimal cyber-attack strategies can be found in pseudo-polynomial time. Third, we provide a list of open problems relating to the architectural design of cyber-security systems and to the model.

Sistem Informasi Manajemen Wisuda Berbasis Website Menggunakan Metode Waterfall

“…Metode waterfall digunakan dalam pengembangan perangkat lunak ini. Metode ini dinilai cocok untuk pengembangan perangkat lunak berskala kecil yang dikerjakan dalam kurun waktu kurang dari enam bulan dan jumlah tim kurang dari tiga orang [3]. Metode waterfall merupakan model klasik yang sifatnya sistematis, pembangunan perangkat lunak dilakukan secara berurutan [4].…”

The Structure of Rooted Weighted Trees Modeling Layered Cyber-security Systems

“…Lemma 4.3. Let M = (T, C, M ) be a CSM where T is a path with its vertices and edges labeled as in (3). (i) If (T, c, p) is a SS for M and there is an i with p i > p i+1 and c i+1 > 0, then the SS (T, c, p ′ ) where p ′ is obtained by swapping the prizes on u i and u i+1 is an improved SS.…”

“…Threats come from nation states with advanced cyber warfare commands, nation states having less technical capabilities but intent on doing harm, ideologically motivated groups of hackers or extremists, profit-seeking criminals, and others. Building on the work done in [3], in this paper we study a layered-security model and strategies for assigning penetration costs and target-acquisition values so as to minimize the amount of damage an attacker can do to a system. That is, we examine security systems.…”

“…To the best of our knowledge this approach is new in that the usual approach is to consider a particular weighted tree as input. For example, in [1,3,4,8,10,12] the authors consider finding weight-constrained, maximum-density subtrees and similar structures given a fixed weighting of a tree as part of the input. In these cases weights are specified on both vertices and edges.…”

“…In [3] the authors posed the following question: Can one mathematically prove that the intuition of storing high-value targets deeper in the system and having higher penetration costs on the outermost layers of the system results in the best or at least good security? In this paper we answer this question and obtain more general and specific results.…”